LobeHub SSOT

2 min read

Upstream sources

These citations ground upstream behavior. The deployed current state remains defined by the local Compose, nginx, environment-template, bucket-policy, and SearXNG source files documented in index.

Deployment basis

  1. LobeHub deployment source at commit 5cb99eecff280c2563de99f8afd1bb7f536db45c
    • basis for the Compose service set, RustFS bucket initialization, bucket policy, and SearXNG settings
    • local deployment changes harden exposure, pin every image digest, add health ordering, attach the existing LiteLLM network, and apply the loca.zone identity and ingress contract

Authentication

  1. LobeHub Authelia provider guide
    • source for the Authelia OIDC provider shape and callback relationship
    • the deployed stack uses the current Better Auth variable names recorded in auth-model
  2. LobeHub authentication configuration
    • source for SSO configuration and disabling email and password authentication
    • deployed control: AUTH_DISABLE_EMAIL_PASSWORD=1

Object storage

  1. LobeHub S3 configuration
    • source for S3-compatible storage settings
    • important endpoint constraint: S3_ENDPOINT must be an origin without a path suffix
    • this is why the deployment uses the dedicated s3.lobe.loca.zone hostname instead of a path under the application hostname

Model provider

  1. LobeHub model-provider environment variables
    • source for OPENAI_PROXY_URL and OPENAI_MODEL_LIST
    • deployed route: http://lllm-proxy:4000/v1
    • deployed display allowlist: -all,+fast,+oss-120b,+free
    • LiteLLM independently enforces the same model boundary through the scoped lobe virtual key

Application image

  1. LobeHub image registry
    • source registry for the application image and manifest digest
    • deployed reference: lobehub/lobehub:2.2.15@sha256:9186fbb2a1cd593eada518560695e1f14f0fa570ed987ba1bf1b3008456422ca

Source precedence

When sources disagree, use this order for the deployment itself:

  1. pinned local docker-compose.yml
  2. installed-source mirror deploy/lobe.nginx.conf
  3. tracked .env.example, bucket.config.json, and searxng-settings.yml
  4. verified live receipts in verification
  5. upstream documentation for behavior and configuration intent

Never infer a deployed value from an upstream example or mutable image tag.